How to install a VPN on Windows 11: 3 methods, settings and fixes for 2026

Installing a VPN on Windows 11 takes about five minutes, and you have three ways to do it. The easiest is the provider app, which installs everything for you. Windows also has a built in VPN client in Settings, and power users can run the official WireGuard app with a configuration file from their provider.

This guide walks through all three methods step by step, explains which one you should pick, lists the settings worth changing after installation, shows you how to test for IP and DNS leaks, and covers the most common Windows VPN errors and how to fix them. Every step was checked against Windows 11 version 24H2 and later.

Quick answer: how to install a VPN on Windows 11

1. Choose a VPN provider with a native Windows 11 app, such as NordVPN, Proton VPN or Surfshark
2. Download the Windows app from the provider's official site or the Microsoft Store
3. Run the installer and accept the Windows prompt that lets it add a network driver
4. Sign in with your VPN account
5. Turn on the kill switch and auto connect in the app settings
6. Click Connect and check your new IP address

If you have not picked a service yet, start with our guide to the best VPN for PC, which compares the leading Windows apps on speed, split tunnelling and ARM support.

Which installation method should you use?

All three methods create an encrypted tunnel, but they differ a lot in effort, speed and features. For most people the provider app is the right answer.

The built in client is useful when your employer or school gives you a server address and login, or when you are not allowed to install software. For personal privacy, streaming and gaming it is slower and lacks the protections a dedicated app gives you.

Before you start

A few quick checks prevent most installation problems:

• Administrator rights: VPN apps install a virtual network adapter, so Windows asks for admin approval. On a work PC you may need IT to approve it.
• Windows updates: open Settings > Windows Update and install pending updates, since outdated network drivers cause many connection errors.
• Your processor type: open Settings > System > About and check System type. If it says ARM based processor, you have a Snapdragon Copilot+ PC and should download the ARM64 version of the app when one is offered.
• Remove old VPNs: two VPN apps fighting over the same network adapter is a common cause of failed connections. Uninstall any you no longer use.
• Your VPN account: have your login ready. For manual setups you also need the server address and the separate service credentials many providers generate for manual connections.

Still on Windows 10? Microsoft ended Windows 10 support in October 2025, so updating to Windows 11 or buying extended updates matters more for your security than any VPN. The steps below also work on Windows 10, with slightly different menu names.

Method 1: install a VPN app on Windows 11 (recommended)

This is the fastest and safest way to get a VPN on Windows 11. The app picks the best protocol, installs its own drivers, and gives you a kill switch, split tunnelling and thousands of servers in one window.

Step 1: download the app from an official source

Go to your provider's website and open its download page, or search for the provider in the Microsoft Store. Only download from these two places. Fake VPN installers on third party download sites are a known way to spread malware.

Step 2: run the installer

Open the downloaded file from your Downloads folder. Windows shows a User Account Control prompt asking if the app can make changes to your device. Click Yes. This lets the installer add the virtual network adapter and the service that keeps the tunnel running.

If Microsoft Defender SmartScreen shows a blue warning, check that you downloaded the file from the provider's real website. Signed installers from major providers rarely trigger it. If you are unsure, delete the file and download it again from the official site.

Step 3: sign in

Launch the app from the Start menu. Most providers now open a browser window for login, then return you to the app. If you have two factor authentication on your VPN account, approve the sign in on your phone.

Step 4: change the key settings

Before your first connection, open the app settings and switch on the protections covered in the settings section below, especially the kill switch and auto connect.

Step 5: connect

Click the large Connect or Quick connect button to join the fastest nearby server, or choose a country from the list. When the status shows Connected, a key icon appears in the system tray and your traffic is encrypted.

Not sure which app to install? NordVPN has the most complete Windows app, with native ARM64 support and two kill switch modes (see our NordVPN review). Proton VPN offers open source apps and a free plan with no data cap, covered in our Proton VPN review. Surfshark covers unlimited devices on one plan, as explained in our Surfshark review.

Method 2: set up the built in Windows 11 VPN client

Windows 11 includes a VPN client that needs no extra software. You add a VPN profile with a server address and login, then connect from Settings or Quick Settings. Microsoft documents the process on its Connect to a VPN in Windows support page.

Step 1: get the details from your provider

You need the server address (for example a hostname such as uk123.provider.com), the VPN type the server supports, and your manual setup username and password. Consumer providers usually list these in your account dashboard under manual setup. For IKEv2 you may also need to install the provider's root certificate.

Step 2: add the VPN connection

1. Open Settings with Windows key + I
2. Go to Network & internet > VPN
3. Click Add VPN next to VPN connections
4. Set VPN provider to Windows (built in)
5. Type a Connection name you will recognise, such as "Provider UK"
6. Paste the Server name or address
7. Pick the VPN type, ideally IKEv2
8. Set Type of sign in info to User name and password, or Certificate if your provider says so
9. Enter your username and password, tick Remember my sign in info, and click Save

Step 3: connect

Back on the VPN page, click Connect next to the new profile. You can also click the network icon in the taskbar to open Quick Settings and use the VPN tile. If the tile is missing, click the pencil icon and add it.

Step 4: install a certificate for IKEv2 (if required)

Many providers sign their IKEv2 servers with their own certificate authority. Download the root certificate from your provider, double click it, choose Install Certificate, select Local Machine, and place it in Trusted Root Certification Authorities. Without this step Windows shows error 13801 or 13806 and refuses to connect.

Which VPN type to choose

Not all built in protocols are equally safe. Microsoft announced in 2024 that PPTP and L2TP are deprecated and will be removed from future Windows versions, and it points users to IKEv2 and SSTP instead.

The main limits of the built in client are clear once you use it: there is no kill switch, no split tunnelling by app, and you need a separate profile for every server you want to use. That is why we only recommend it for work VPNs.

Method 3: install WireGuard manually on Windows 11

WireGuard is the fastest modern VPN protocol, and the official Windows app is small and reliable. This method suits people who run their own server, use a provider without a Windows app, or want a lightweight setup with no extra features.

1. Download the installer from the official WireGuard install page. Advanced users can also run winget install WireGuard.WireGuard in Terminal.
2. Run the installer and approve the User Account Control prompt.
3. In your VPN account, create a WireGuard configuration file for the server you want. Proton VPN, Surfshark and many others offer this under manual setup.
4. Open WireGuard and click Import tunnel(s) from file, then choose the downloaded .conf file.
5. Click Edit and make sure Block untunneled traffic (kill switch) is ticked. It appears when the tunnel routes all traffic.
6. Click Activate. The status turns green and shows data sent and received.

Keep your configuration files private. Each one contains a private key, and anyone who copies it can use your connection. Delete the downloaded file after importing it.

Settings to change after installing a VPN

The default settings in most apps are fine, but a few changes give you much better protection on Windows 11:

• Kill switch: blocks all internet traffic if the VPN drops, so your real IP never leaks. Use the system wide or permanent mode if offered.
• Launch at startup and auto connect: connects before you open a browser, and on untrusted WiFi networks automatically.
• Protocol: leave it on Automatic, or choose WireGuard (NordLynx on NordVPN, Lightway on ExpressVPN) for the best speed.
• DNS and threat protection: use the provider's DNS servers and turn on ad and malware blocking if available.
• Split tunnelling: exclude apps such as local banking, printers or games that work better on your normal connection.
• Obfuscation: turn on stealth or obfuscated servers if you are on a network that blocks VPNs, such as some offices, campuses or hotels.

If you play online, keep the VPN server close to the game servers to limit ping. Our best VPN for Warzone guide explains how distance and protocol affect latency.

How to check your VPN is working

A connected icon does not prove you are protected. Run these three checks after your first connection:

1. IP check: search "what is my IP" before and after connecting. The address and location should change to the VPN server.
2. DNS leak test: run an extended test on a site such as dnsleaktest.com. You should only see your VPN provider's servers, not your internet provider's.
3. Kill switch test: while connected, disconnect your WiFi briefly or close the VPN service. Websites should stop loading until the tunnel returns.

Also check for WebRTC leaks in your browser, since video calling features can reveal your real IP. Most provider browser extensions block this for you.

Common Windows 11 VPN errors and how to fix them

If nothing helps, reset the network stack. Open Terminal as administrator and run ipconfig /flushdns and netsh winsock reset, then restart. As a last resort, go to Settings > Network & internet > Advanced network settings > Network reset, which reinstalls all network adapters. You will need to reinstall your VPN app afterwards.

Streaming services sometimes block VPN servers too, which looks like a connection problem but is not. Our guide to fixing the HBO Max VPN error covers that case in detail.

How to remove a VPN from Windows 11

To remove a VPN app, open Settings > Apps > Installed apps, find the VPN, click the three dots and choose Uninstall. Restart afterwards so the virtual adapter is removed cleanly.

To delete a built in VPN profile, go to Settings > Network & internet > VPN, expand the connection and click Remove. For WireGuard, select the tunnel and click the delete button, then uninstall the app from Installed apps if you no longer need it.

Is a VPN on Windows 11 worth it?

For most people, yes. A VPN encrypts your traffic on public WiFi, hides your browsing from your internet provider, and lets you reach your home services while travelling. It does not replace good habits, though. Keep Windows updated, use a password manager and turn on two factor authentication. The Electronic Frontier Foundation's guide to choosing a VPN is a useful, neutral read on what a VPN can and cannot do.

When choosing a provider, look for an audited no logs policy, a native Windows app with a kill switch, and a refund window long enough to test it. Our main best VPN ranking compares the top services across every device.

FAQ

Does Windows 11 have a free built in VPN?

Windows 11 has a built in VPN client, not a VPN service. You still need a server to connect to, either from a VPN provider or from your employer. The client is free, but it lacks a kill switch and server switching.

Do I need admin rights to install a VPN on Windows 11?

Yes, for provider apps and WireGuard, because they install a network driver. Adding a profile to the built in client usually works without admin rights, which is why it is common on managed work laptops.

Which protocol should I use on Windows 11?

Use WireGuard or your provider's version of it for the best speed. In the built in client, choose IKEv2. Avoid PPTP completely.

Can I use a VPN on a Windows 11 ARM laptop?

Yes. NordVPN, Proton VPN and Surfshark offer native ARM64 Windows apps, and the WireGuard app also runs natively. Other apps may work through Microsoft's emulation with some driver limits.

Why does my VPN connect but websites will not load?

This is usually a DNS or driver conflict. Try another server, switch protocol, remove other VPN apps, and flush DNS with ipconfig /flushdns. If the kill switch is on and the tunnel failed, it is also doing its job by blocking traffic.

Will a VPN slow down my Windows 11 PC?

A modern protocol on a nearby server usually costs only a small share of your speed, which most people never notice. Long distance servers and older protocols such as OpenVPN TCP slow things down more.

Can I install a VPN on Windows 11 S mode?

In S mode you can only install apps from the Microsoft Store. Several providers, including NordVPN and Surfshark, publish their apps there. You can also use the built in client.